Techniques to Evolve Risk Governance and Comply with SEC Cybersecurity Rule
summary
Argues that legal defensibility requires assessing harm to others using DoCRA (duty of care) not just internal CIA scores, cites adoption (10+ states, ~140,000 downloads) and that CIS adopted the engine as CIS RAM. Shows concrete artifacts: a multi‑user risk database, an executive dashboard that reports at the press of a button, a roadmap view with an acceptable‑risk line (example: acceptable = 8, current avg = 15.3, crosses line in two months). Provides templates, videos and a turnkey app link (halock.com/rsa2024).
AI-written summary · about
chapters (19)
- 0:00SEC cybersecurity governance challenges
- 1:03Industry frameworks for governance
- 2:05Governance 1.0 to 2.0 evolution
- 4:33Skipping governance 1.0
- 5:39Five governance 2.0 capabilities
- 6:43Risk assessment fundamentals
- 9:35DoCRA for legal defensibility
- 13:57SEC rule requirements alignment
- 16:51Acceptable risk line
- 19:45DoCRA for business communication
- 21:34Tracking organizational risks
- 23:18Risk reduction roadmap
- 29:38Executive reporting structure
- 36:23Governance 2.0 benefits
- 37:45Governance 2.0 timeline
- 38:49Q&A on risk assessment
- 42:03DoCRA integration methods
- 43:51Harm assessment scope
- 46:45Closing remarks
related talks
40mProtecting What Matters Most – Tools for Managing Risk
27mSolving CISO Headaches: How to Align CTI and Risk Management
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
51mDo Better: Board-Level Accountability in Cybersecurity
28mHow to Tell the Right Cyber-Story to Executives and Board Members
36mNot Your Mama's Risk Assessment
31mReverse Engineering Compliance
15mFrom Risk to Return: Measuring Cybersecurity ROI with Data Analytics